OPNsense vs. FortiGate for the mid-market 2026: where open source wins and where Fortinet is still ahead

The question lands on the table in the mid-market almost every year now: OPNsense or FortiGate? The Fortinet contract is up for renewal, the FortiCare quote arrives, and suddenly the licence bill sits next to a proposal for an open-source firewall with hardware sourced in the DACH region. We sit in these decisions on a regular basis and in this article we write down what we have actually seen over the last two years — no benchmarks nobody can verify, no vendor bashing.

This comparison is written for managing directors, IT leads and admins in mid-market shops between 20 and 300 users, who want to know where both worlds hit their limits. For pure enterprise setups with hundreds of branches and a global SOC, the rules shift — we deliberately keep those out of scope.

OPNsense vs FortiGate: two fundamentally different licence models

The decisive difference is not the UI or the ruleset, it is the commercial model. Once you understand that, you have already made 80 percent of the decision.

FortiGate: subscription per appliance

Fortinet sells the hardware once and stacks one or more service bundles on top — previously ATP and UTP, today Enterprise Protection and similar packages. Everything you would call a modern firewall feature sits on the subscription:

• FortiGuard IPS, antivirus, web filter, application control — annual licence per device
• FortiCare support — annual licence, no RMA without it
• SD-WAN features such as ADVPN require the right licence tier
• FortiManager and FortiAnalyzer — separate appliances or cloud instances, often their own licences
• VDOM licences for multi-tenant setups cost extra

Positive: the first-year price often looks harmless because Fortinet discounts aggressively in enterprise deals. After three to five years the licence curve steepens, since renewals rarely hold the first-year price. Hardware lock-in is a second point: when you move to the next generation, licences do not migrate — you need to plan for it.

OPNsense: hardware-only with optional Business Edition

With OPNsense the software is free and complete. All features from day one — no artificial tiering, no licensed add-ons. What costs money:

• Hardware — either from a reseller like DATAZONE or sourced yourself
• OPNsense Business Edition — optional subscription with calmer release cycles and commercial support via Deciso
• External threat feeds — Suricata rules, GeoIP databases, CrowdSec, if you want commercial sources
• Partner support — monthly or annual retainer with a service provider like us

The upside: the software keeps running even if no contract exists. The licence curve is flat and predictable, and the whole thing also runs on second-hand or repurposed hardware. The downside: there is no vendor SOC calling at 3am, and no single hotline covering four time zones worldwide. In our setup the partner covers that.

Feature comparison: where FortiGate is still ahead

For all OPNsense wins, let’s be honest: there are areas where FortiGate is objectively further along. You should know these points before you kick off the migration.

SD-WAN

FortiGate has one of the most mature SD-WAN concepts in the market. Application-aware steering, SLA-based routing, ADVPN with on-demand shortcut tunnels between branches — in the FortiOS world this is a commercial product with its own GUI in FortiManager. OPNsense has multi-WAN with policy-based routing, gateway groups and monitoring, but no product branded SD-WAN. For a setup with three WAN links and ten branches that is cleanly enough. For fifty branches with dynamic hub-and-spoke topology, FortiGate is clearly the more comfortable path.

SSL/TLS inspection

TLS inspection on FortiGate is a one-click story: generate the certificate, enable the policy, maintain exceptions for banking and health-check traffic — done. The ASIC-accelerated models handle it without visible performance hits even at larger throughputs. On OPNsense, TLS inspection is available via Squid with a MITM certificate — it works technically, but it is harder to operate and maintain. For the mid-market the honest question is whether TLS inspection is worth it at all. In production we see it mostly where cyber insurance or an industry standard demands it.

Reporting and threat dashboards

FortiAnalyzer gives you a packaged threat landscape out of the box, scheduled PDF reports and a compliance view that looks good in an audit. OPNsense gives you the raw data — logs, Suricata events, Netflow — and you typically build your own reporting on top of ELK/OpenSearch, Graylog or Grafana Loki. For a 50-user law firm that is overkill, for a production plant with audit obligations you can get the first months off your plate with a FortiAnalyzer licence relatively quickly.

Vendor support and global time zones

FortiCare with 24/7 hotline in multiple languages is a real advantage for an enterprise with branches across Asia and North America. With OPNsense you either have a partner contract with defined response times or community support. For the DACH mid-market that is often entirely enough, but honestly: for a global operation with its own follow-the-sun concept, the Fortinet logic fits better.

Where OPNsense beats FortiGate

Now the other side. In the following areas OPNsense wins — clearly.

Licence cost over five years

If you run a mid-sized FortiGate appliance with Enterprise bundle over five years and place a comparably sized OPNsense appliance with partner support next to it, OPNsense lands significantly cheaper in almost every scenario. Concrete numbers depend on project and move with hardware and support prices — so no benchmark figures here, but an honest TCO calculation on request. We’ve written about this logic in detail for storage in our cloud vs TrueNAS TCO article; for firewalls the structure is the same.

Data sovereignty and transparency

OPNsense is open source. Every line of code is visible, every update channel is traceable, and there are no proprietary telemetry streams the admin needs to disable first. For public bodies, law firms, tax advisors and companies with a serious GDPR focus, this is not a marketing point — it is a hard compliance advantage. Our article on firewalls for small businesses 2026 covers the size classes beside this.

Extensibility without licence gates

If you need an extra feature on OPNsense — CrowdSec, Zabbix agent, Netdata, Netflow export, extra VPN protocols — you install a plugin or adjust the configuration. No extra SKU, no activation code, no new hardware model needed. For the typical mid-market setup with WireGuard for home office, IPsec to partner sites and Suricata as IDS, this is enormously comfortable. See also Fortinet FortiGate migration to OPNsense for the concrete migration path.

Hardware flexibility

OPNsense runs on a slim DEC appliance from Deciso just as well as on a Supermicro server, a Dell edge box or a virtual machine on an existing Proxmox cluster. That makes consolidation and refresh strategies easier. FortiGate is bound to its own hardware or at least FortiOS-certified environments. For hardware sizing we’ve written up our thoughts in the OPNsense hardware recommendation 2026.

When OPNsense, when FortiGate — our decision matrix

Instead of a blanket recommendation, these are the questions we actually ask in the first conversation.

Reasons to go with OPNsense

• 20 to 150 users, one to five sites, no global branch structure
• Existing open-source mindset in the team or at the service provider
• Data sovereignty, transparency or GDPR focus carries real weight
• Predictable, flat licence curve matters more than a vendor SOC
• Monitoring and logging are handled by a stack like Graylog, Zabbix or ELK
• Fortinet experience in-house matters less than Linux/BSD experience
• A partner model with SLA via a provider like DATAZONE is acceptable

Reasons to stay with FortiGate

• Enterprise setup with ten or more branches, SD-WAN truly needed
• Fortinet ecosystem already in place — FortiSwitch, FortiAP, FortiClient
• 24/7 vendor support across time zones is mandatory
• Audit reports and compliance dashboards must come out of the box
• TLS inspection is operationally non-negotiable and must scale
• The team holds FortiOS certifications and has no appetite to relearn

Both worlds can succeed in the mid-market — we support both. What we have been seeing much more often over the last two years is the move from FortiGate to OPNsense in shops between 20 and 150 users. The reason is almost always the second or third renewal invoice, when the board starts looking at five-year TCO.

Migration path — what to plan for

If you move from FortiGate to OPNsense, do not let yourself be fooled by surface-level UI comparisons. The concepts are similar but the tools have different names. Firewall policies can be mapped onto OPNsense’s first-match ruleset, VPN configurations usually need to be rebuilt, and monitoring must run in parallel until cutover happens overnight. We recommend a two-stage operation over two to four weeks — it is far more relaxed than any big-bang. Details are in the linked migration article.

On the hardware side, you either take a ready OPNsense appliance from us or use existing server capacity. For backups and archives that should play well with the new firewall world, a TrueNAS system is often the right second building block — our TrueNAS configurator and TrueNAS support are used by mid-market shops that want to consolidate both worlds.

FAQ on OPNsense vs FortiGate

Is OPNsense really a serious FortiGate alternative for the mid-market?

Yes — in the 20 to 150 user class without a global branch structure, OPNsense is functionally complete. Limits show up around industrial SD-WAN with many sites, out-of-the-box compliance reporting and global 24/7 vendor support.

What does an OPNsense solution cost over five years compared with FortiGate?

Concrete numbers depend heavily on hardware class, user count and support model — which is why we don’t quote a flat EUR figure here. In projects we have actually delivered, OPNsense regularly lands significantly below FortiGate with a comparable Enterprise bundle over five years. We produce an individual TCO calculation on request.

Can OPNsense do SD-WAN like FortiGate?

Partially. Multi-WAN with policy-based routing, gateway monitoring and load balancing come cleanly with OPNsense. What is missing is a packaged SD-WAN product with a central GUI for a hundred branches and automated hub-and-spoke shortcuts. For the typical mid-market this is fine — for a franchise with 80 outlets, FortiGate is simply more comfortable.

What happens to my FortiGate hardware during the migration?

Usually it is retired or resold. OPNsense runs on its own hardware. Some customers keep the FortiGate as a cold spare in the rack for six to twelve months in case of operational catch-up — technically it is not required.

What support does DATAZONE offer for OPNsense?

We offer monthly and annual retainers for OPNsense with defined response times, including proactive patch management, monitoring and a predictable maintenance budget. Details on our page about OPNsense as an IT service.

How long does a typical FortiGate to OPNsense migration take?

For an SMB with a single site, ten to thirty users, two VPN connections and standard policies we plan on two to four weeks including a test phase. Larger setups with multiple sites, dual WAN and a VLAN zoo need longer — but we have migrated those within planned maintenance windows too.